One or more Holder keys

[Sakurann]

feedback received:

---

The payload MAY also contain a Holder's public key or a reference thereto…

This seems to be a restriction to 0 or 1 public key. But it could be beneficial to support more than 1 key pair, e.g. for different purposes (signature and key agreement) or for different communities (ECDH keys supporting different curves for different communities) etc.

An alternative would of course be to issue an SD-JWT for every public key separately, but the SD-JWT specification should leave the decision on the approach to the issuer.

Suggestion is to change to "The payload MAY contain one or more public keys of the holder or references thereto….".

[bc-pi]

318 has changes that would address this, I think - https://github.com/oauth-wg/oauth-selective-disclosure-jwt/pull/318/files#diff-40bc3800dd9a7d4411799637caf0b01f82a01242d57264a2e4beb408c3835704R258

[Sakurann]

PR merged